Operation on a Resource after Expiration or Release in PostgreSQL - CVE-2026-116336
Published: November 12, 2026
Vulnerability identifier: #VU166102
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116336
CWE-ID: CWE-672
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to improper management of index lifetime in PostgreSQL REINDEX CONCURRENTLY when evaluating index expressions. A remote user can create an index expression that issues DROP INDEX, causing the operation to continue using a dropped index, to execute arbitrary code as the operating system user running the database.
Affected software
PostgreSQL
How to mitigate CVE-2026-116336
Install security update from vendor's website.
PostgreSQL - addressed in versions 14.25, 15.20, 16.16, 17.12, 18.7